How to Assure Cloud Services

The report explains how organizations can gain security and compliance assurance for cloud services using standards, independent certifications, and attestations, within a broader IT governance approach. Cloud adoption is widespread and often underestimated, spanning strategic transformation (closer customer engagement, agility, rapid development), cost reduction for commodity IT (email, CRM), and informal employee use to “get the job done.” Moving services to the cloud shifts direct operational control to the Cloud Service Provider (CSP), changing the risk and compliance landscape; yet customers still control important aspects, creating a shared-responsibility model that varies by service type (IaaS, PaaS, SaaS). As a result, customers must ensure controls they own are implemented internally, while assuring—rather than directly controlling—that the CSP delivers the service securely to an agreed, measurable specification.

Assurance begins with governance: defining business objectives, setting risk appetite, creating a cloud-use policy, embedding cloud into standard procurement, and conducting risk assessments that yield measurable controls linked to business requirements. Because CSPs generally cannot support individual customer audits, assurance typically relies on contracts/SLAs, CSP assertions, and independent third-party validation or testing (e.g., SOC reports), supplemented by limited direct customer measurement for certain metrics like availability. The report stresses a risk-based approach: not all risks merit the same assurance level, and organizations should prioritize.

Operationally, Cloud Access Security Brokers (CASBs) help enforce cloud-use policies, detect unsanctioned services, and control sensitive data exposure—especially with mobility and “shadow IT.” The report also outlines key standards and programs (ISO/IEC 27001/27017/27018, CSA STAR, BSI C5, SOC reports) and emphasizes aligning assurance evidence to the specific risks and measurement needs defined during procurement and monitored throughout service delivery.

• Cloud services are used for business transformation, cost reduction for commodity IT (including email and CRM), rapid development, and ad hoc employee productivity.
• Responsibility for security and compliance is shared between the cloud customer and the CSP.
• In IaaS, the CSP is responsible for securing the infrastructure, while the customer is responsible for security from the operating system upwards.
• In PaaS, the CSP is responsible for infrastructure and managed middleware security, while the customer is responsible for securing how those services are used.
• In SaaS, the CSP is responsible for the security of the infrastructure, operating system, middleware, and application.
• Many CSPs do not allow individual customer audits because it would create an intolerable burden.
• ENISA published “Procure Secure” in April 2012 as a guide to monitoring security service levels in cloud contracts.
• ENISA “Procure Secure” identifies parameters including availability, incident response, elasticity/load tolerance, data lifecycle management, vulnerability management, change management, data isolation, and log management/forensics.
• SOC reports include SOC 1, SOC 2, and SOC 3, each intended for different assurance and audience purposes.
• SOC Type 2 reports address both the design and operating effectiveness of controls, unlike Type 1.

• “The customer organization must ensure that the controls for which it is responsible are implemented.”
• “Since the delivery of the cloud service is outside the direct control of the customer, it can only assure that the service is delivered securely to the agreed specification.”
• “A governance based approach allows trust in the CSP to be assured through a combination of internal processes, standards and independent assessments.”
• “Not all risks are equal – you need to prioritize which risks are important and ensure the appropriate level of assurance based on this.”
• “Understand the different levels of assurance available and require what is appropriate for your individual circumstances.”
• “Define what must be measured to provide assurance during the procurement process.”
• “Organizations should require CSPs to provide evidence that their service complies with industry standards and best practices.”
• “Use CASBs to ensure that cloud usage is well governed.”
• “You can expect the service provided to meet the contract no more and no less.”
• “Choosing a CSP that complies with either of these codes does not remove responsibility from a customer who is also the Data Controller.”